[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Assessing Federal and Commercial Information Security Needs:

For organizations that process unclassified sensitive information, the availability of a greater variety of trusted products that go beyond C2 in terms of functionality and flexibility is needed. There is a demand to address data integrity in a more direct and user friendly manner. Vendors should consider new mechanisms that directly address discretionary and non~discretionary controls, such as role-based access controls, separation of duties, separation of transactions, and user-oriented least privilege.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.2 (NIST 3.1.2)?

[Assistant]
According to Guide to Integrating Forensic Techniques into Incident Response:

3.1.2 Acquiring the Data... 3.1.2, organizations should determine in advance which actions should be performed by law enforcement officials. 3.1.2 describes the recommended steps for collecting data, including additional actions necessary to support legal or internal disciplinary proceedings.

Guide to Integrating Forensic Techniques into Incident Response


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Approximate Matching_ Definition and Terminology provide?

[Assistant]
## NIST Special Publication 800-168

## Approximate Matching: Definition and Terminology

Frank Breitinger Barbara Guttman Michael McCarrin Vassil Roussev Douglas White http://dx.doi.org/10.6028/NIST.SP.800-168

<!-- image -->

## NIST Special Publication 800-168

## Approximate Matching: Definition and Terminology

Frank Breitinger University of New Haven West Haven, CT

Douglas White Barbara Guttman Software and Systems Division Information Technology Laboratory

Michael McCarrin Naval Postgraduate School Monterey, CA

Vassil Roussev University of New Orleans New Orleans, LA

http://dx.doi.org/10.6028/NIST.SP.800-168

May 2014

<!-- image -->

U.S. Department of Commerce Penny Pritzker, Secretary

National Institute of Standards and Technology

Patrick D. Gallagher, Under Secretary of Commerce for Standards and Technology and Director

## Authority

This publication has been developed by National Institute of Standards and Technology (NIST) to further its statutory responsibilities under the Federal Information Security Management Act (FISMA), Public Law (P.L.) 107-347. NIST is responsible for developing information security standards and guidelines, including minimum requirements for Federal information systems, but such standards and guidelines shall not apply to national security systems without the express approval of appropriate Federal officials exercising policy authority over such systems. This guideline is consistent with the requirements of the Office of Management and Budget (OMB) Circular A-130, Section 8b(3), Securing Agency Information Systems , as analyzed in Circular A 130, Appendix IV: Analysis of Key Sections . Supplemental information is provided in Circular A-130, Appendix III, Security of Federal Automated Information Resources . Nothing in this publication should be taken to contradict the standards and guidelines made mandatory and binding on Federal agencies by the Secretary of Commerce under statutory authority.

Approximate Matching_ Definition and Terminology

Planning
System and Services Acquisition
Physical Protection
Awareness and Training
Incident Response
Supply Chain Risk Management
Maintenance
System and Communications Protection
Security Assessment
Media Protection
Risk Assessment
Audit and Accountability
Personnel Security
Identification and Authentication
Access Control
System and Information Integrity


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Guidelines on Security and Privacy in Public Cloud Computing:

Organizations should employ appropriate security management practices and controls over cloud computing. Strong management practices are essential for operating and maintaining a secure cloud computing solution. Security and privacy practices entail monitoring the organization's information system assets and assessing the implementation of policies, standards, procedures, controls, and guidelines that are used to establish and preserve the confidentiality, integrity, and availability of information system resources. Opportunities  for  improved  security  also  benefit  privacy. That  is,  effective  privacy  can  exist only upon a sound foundation of information security. However, privacy, just as security, has broad organizational, operational, and technical implications. While some aspects of privacy are closely  related  to  the  confidentiality,  integrity,  and  availability  objectives  of  security,  other aspects  are  not. Instead,  they  involve  important  privacy-related  principles  and  considerations that are addressed in law, regulations, and OMB guidance [CIO10b]. ▪ Mechanism  Cracking. WiFi  Protected  Access  (WPA)  Cracker,  a  cloud  service ostensibly  for  penetration  testers,  is  an  example  of  harnessing  cloud  resources  on demand to break a cryptographic cipher and determine the encrypted password used to protect a wireless network. Through this service, a task that would take five days to run on a single computer can be accomplished in only 20 minutes on a cluster of 400 virtual machines  [Rag09]. Because  cryptography  is  used  widely  in  authentication,  data confidentiality and integrity, and other security mechanisms, these mechanisms become, in effect, less effective with the availability of cryptographic key cracking cloud services. Both cloud-based and traditional types of systems are possible targets.

Guidelines on Security and Privacy in Public Cloud Computing


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Digital Identity Guidelines_ Federation and Assertions:

|            | 3.6.2. | Cryptographic Key Storage . . . . . . . . . . . . . . . . . . . . . 27    |
|------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------|
| 3.7. | 3.6.3. Software Attestations . . . . . . Authentication and Attribute Disclosure . | . . . . . . . . . . . . . . . . . 27 . . . . . . . . . . . . . . . . . 27 |
| 3.8. | RP Subscriber Accounts . . . . . . . . . | . . . . . . . . . . . . . . . . . 28                                      |
|            | 3.8.1. Account Linking . . . . . . . . . . . . . . . . | 29                                                                        |
|            | . . . . . . . . . . 3.8.2. Account Resolution . . . . . . . . . . . . . . . . . . . . . . . . 3.8.3. Alternative Authentication Processes . . . . . . . . . . . . . . . Authenticated Sessions at the RP . . . . . . . . . . . . . . . . . . . . . | 30 30 31                                                                  |
|            | 3.13.2. Signed Assertion . . . . . . . . . . . . . . . . . . . . . . . . . . . | . . . . . . . . . . . . . |
| 3.9. 3.11. | 3.10.2. Sharing Information Between CSPs Identity Attributes . . . . . . . . . . . . 3.13.3. Encrypted Assertion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . | . . . . . . . . . . . . . . . . 34 . . . . . . . . . . . . . . . 42       |
|            | 3.12.1. Attribute Bundles . . . . . . . . | 32 . . . . . . . . . . . . . . . |
| 3.10. | Privacy Requirements . . . . . . . . . . . . . . . . . . . . . . . . 3.10.1. Transmitting Subscriber Information . . . . . . . . . . . . | . . . . . . 33                                                            |
| 3.12. | 3.11.1. Protection From Assertion Injection Attacks . .

Digital Identity Guidelines_ Federation and Assertions


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Enterprise Impact of Information and Communications Technology Risk_ Governing and Managing ICT Risk Programs Within an Enterprise Risk Portfolio:

............................................................... 1   | Executive Summary.................................................................................................................
1   |
|----------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------|
|                                                                                | Introduction ...................................................................................................................... | 5                                                                                |
| 1.1                                                                                | Purpose and Scope.................................................................................................... | 5                                                                                |
| 1.2                                                                                | Document Structure.................................................................................................... | 6                                                                                |
| Introduction to ICTRM and Challenges with ERM Integration.......................................

Enterprise Impact of Information and Communications Technology Risk_ Governing and Managing ICT Risk Programs Within an Enterprise Risk Portfolio


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Information Integrity?

[Assistant]
According to Guidelines on PDA Forensics:

The object store refers to three types of persistent storage supported by Windows CE within the Operating System Layer: file system, registry, and property databases. Standard Win32 functions  provide  access  to  files  and  the  registry,  while  new  Windows  CE-specific  API functions  provide  access  to  property  databases  and  certain  registry  features. The  subset  of Win32 and other Microsoft APIs implemented in Pocket PC allows a system to fulfill the requirements  of  an  embedded  application,  yet  keep  the  programmability  similar  to  that  of Windows PCs. The maximum size of the object store is 256MB in Windows CE. The object store  is  built  on  an  internal  heap  that  resides  in  RAM,  ROM,  or  both. The  internal  heap provides a transaction model that uses logging to ensure the integrity of the object store data. documentation  features. 21 Although  more  widely  used  for  examining  PCs,  EnCase  also supports Palm OS devices. Currently, support for Pocket PC is not available, but the ability to import a data dump of Linux-based PDAs exists. EnCase allows for the creation of a complete physical bit-stream image of a Palm OS device. Throughout the process, the integrity of the bit-stream image is continually verified by CRC (Cyclical Redundancy Check) values, which are  calculated  concurrent  to  acquisition. The  resulting  bit-stream  image,  called  an  EnCase evidence file, is mounted as a read-only file or 'virtual drive' from which EnCase proceeds to reconstruct the file structure using the logical data in the bit-stream image. This allows the examiner to search and examine the contents of the device using either a logical or physical perspective. The above sets of principles aim to ensure the integrity and accountability of digital evidence through its entire life cycle. Proper handling of evidence is always vital for it to be admissible in  judicial  proceedings.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What guidance does Federal S_MIME V3 Client Profile provide?

[Assistant]
NIST Special Publication 800-49

<!-- image -->

## Federal S/MIME V3 Client Profile

C. Michael Chernick

## C  O  M  P  U  T  E  R S  E  C  U  R  I  T  Y

November 2002

## NIST Special Publication 800-49 Federal S/MIME V3 Client

## Profile

## Recommendations of the National Institute of Standards and Technology

## C. Michael Chernick

## C O  M  P  U  T  E  R S  E  C  U  R  I  T  Y

Computer Security Division Information Technology Laboratory National Institute of Standards and Technology Gaithersburg, MD 20899-8930

## November 2002

<!-- image -->

U.S. Department of Commerce

## Donald L. Evans, Secretary

Technology Administration

## Phillip J. Bond, Under Secretary of Commerce for Technology

National Institute of Standards and Technology

## Arden L. Bement, Jr.,  Director

## Reports on Information Security Technology

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST)  promotes  the  U.S. economy  and  public  welfare  by  providing  technical  leadership  for  the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analysis to advance the development and productive use  of  information  technology. ITL's  responsibilities  include  the  development  of  technical,  physical, administrative, and management standards and guidelines for the cost-effective security and privacy of sensitive  unclassified  information  in  Federal  computer  systems. This  Special  Publication  800-series reports  on  ITL's  research,  guidance,  and  outreach  efforts  in  computer  security  and  its  collaborative activities with industry, government, and academic organizations. Certain  commercial  entities,  equipment,  or  materials  may  be  identified  in  this  document  in  order  to  describe  an experimental  procedure  or  concept  adequately.

Planning
System and Services Acquisition
Physical Protection
Awareness and Training
Incident Response
Supply Chain Risk Management
Configuration Management
Maintenance
Security Assessment
System and Communications Protection
Media Protection
Risk Assessment
Audit and Accountability
Personnel Security
Identification and Authentication
Access Control
System and Information Integrity


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Advanced Encryption Standard (AES):

The block ciphers AES-128, AES-192, and AES-256 differ in three respects: 1) the length of the key; 2) the number of rounds, which determines the size of the required key schedule; and 3) the specification of the recursion within KEYEXPANSION(). For each algorithm, the number of rounds is denoted by Nr , and the number of words of the key is denoted by Nk . (The number of words in the state is denoted by Nb for Rijndael in general; in this Standard, Nb = 4.) The specific values of Nk , Nb , and Nr are given in Table 3. No other configurations of Rijndael conform to this Standard.

The first step (Line 2) is to copy the input into the state array using the conventions from Sec. 3.4. After an initial round key addition (Line 3), the state array is transformed by Nr applications of the round function (Lines 4-12); the final round (Lines 10-12) differs in that the MIXCOLUMNS() transformation is omitted. The final state is then returned as the output (Line 13), as described in Section 3.4.

To implement INVCIPHER(), the transformations in the specification of CIPHER() (Section 5.1) are inverted and executed in reverse order. The inverted transformations of the state - denoted by INVSHIFTROWS(), INVSUBBYTES(), INVMIXCOLUMNS(), and ADDROUNDKEY() - are described in Sections 5.3.1-5.3.4.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to CMVP Documentation Requirements_ CMVP Validation Authority Updates to ISO_IEC 24759:

Conformance testing; Cryptographic Module Validation Program; CMVP; FIPS 140 testing; FIPS 140; ISO/IEC 19790; ISO/IEC 24759 testing requirement; vendor evidence; vendor documentation.

This document is focused toward the vendors, testing labs, and CMVP for the purpose of addressing issues in ISO/IEC 24759, Test requirements for cryptographic modules .

Federal Information Processing Standard (FIPS) 140-3 documentation requirements are specified in ISO/IEC 19790. This document specifies any additional requirements specified by the Cryptographic Module Validation Program (CMVP) for evidence that vendors provide to a Cryptographic and Security Testing Laboratory (CSTL) to demonstrate conformity. Unless otherwise modified in this document, the test requirements are specified in ISO/IEC 24759.

CMVP Documentation Requirements_ CMVP Validation Authority Updates to ISO_IEC 24759


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Cybersecurity of Genomic Data:

| Introduction....................................................................................................................1 | Introduction....................................................................................................................1 | Introduction....................................................................................................................1 | |-------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------| | | Cybersecurity and Privacy Concerns.........................................................................1 | | | | Document Scope and Goals......................................................................................2 | | | Background....................................................................................................................3 | Background....................................................................................................................3 | Background....................................................................................................................3 | | | Genomic Information Lifecycle | ..................................................................................3 | | | Next Generation Sequencing.....................................................................................4 | | | | Variant Calling | ...........................................................................................................4 | | | Genome Editing.........................................................................................................5 | | | | Direct-to-Consumer Testing.......................................................................................5 | | | | The Characteristics of Genomic Data........................................................................6 | | | | Balance Between Benefits and Risks for Uses of Genomic Information | ...................7 | | Challenges and Concerns Associated with Handling Genomic Information...........9 | Challenges and Concerns Associated with Handling Genomic Information...........9 | Challenges and Concerns Associated with Handling Genomic Information...........9 | | | Potential National Security Concerns ........................................................................9 | | | 3.2.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Workshop Summary Report for “Building on the NIST Foundations_ Next Steps in IoT Cybersecurity” provide? (Part 4)

[Assistant]
uct security officers and security architects at IoT product manufacturers and those in their supply chain; cybersecurity test and evaluation experts; and other stakeholders in the IoT product market.
This publication may also help customers or integrators of IoT products who are adopting IoT technologies in their residence or business, especially small business networks, as well as organizations concerned with conformity assessment of IoT products to published guidance. ## Table of Contents

| Introduction.........................................................................................................................1   | Introduction.........................................................................................................................1   | Introduction.........................................................................................................................1   |
|------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------|
| Appendix                                                                                | A. | Poll Results ......................................................................................................16                    |
|                                                                                | B.

Workshop Summary Report for “Building on the NIST Foundations_ Next Steps in IoT Cybersecurity”


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for Security Assessment?

[Assistant]
According to Personal Identity Verification (PIV) of Federal Employees and Contractors:

ion . . . . . . . . . . | 85    |      |
| 7.2 Federation Assurance Level . . . . . . . . . . . . | 85    |      |
| 7.3 Benefits of Federation . . . . . . . . . . . . . | 86    |      |
| Appendix A.
PIV Validation, Certification, and Accreditation                                                             | 87    |      |
| A.1 Accreditation of PIV Card Issuers and Derived PIV Credential Issuers                                                 | 87    |      |
| A.2 Application of Risk Management Framework to IT Systems                                                               | 87    |      |
| A.3 Conformance Testing of PIV Card Application and                                                                      | 88    |      |
| A.4 Cryptographic Testing and Validation . . . . . . . . . . . . . . | 88    |      |
| A.5 FIPS 201 Evaluation Program . . . . . . . . | 89    |      |
| Appendix B. PIV Object Identifiers and Certificate Extension                                                             | 90    |      |
| B.1 PIV Object Identifiers . . . . . . . . . . . . . . . . | 90    |      |
|                                                                                | 92    |      |
| Appendix C. Glossary of Terms, Acronyms, and Notations                                                                   | 93    |      |
| C.1 Glossary of Terms . . . . . . . . . . . . . | 93    |      |
| C.2 Acronyms and Abbreviations . . . . . . . . . . . . . C.3 Notations . . . . . . . . . . . . . . . . . . . . . . . | 102   |      |
|                                                                                | 109   |      |
| Appendix D. References . . . . . | 110   |      |
| Appendix E. Revision History . . . . . . . . . . . . . . . . . . .

Personal Identity Verification (PIV) of Federal Employees and Contractors


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.6 (NIST 3.1.6)?

[Assistant]
According to Hardware-Enabled Security_ Enabling a Layered Approach to Platform Security for Cloud and Edge Computing Use Cases:

3.1.6 Arm RME and Debug, Trace, Profiling, and Performance Monitoring Protection

Arm systems include extensive features to support debugging, tracing, and profiling.

Hardware-Enabled Security_ Enabling a Layered Approach to Platform Security for Cloud and Edge Computing Use Cases


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Security Considerations for Remote Electronic UOCAVA Voting:

This document has been prepared by the National Institute of Standards and Technology (NIST) and describes research in support military and overseas voting for the Election Assistance Commission and the Technical Guidelines Development Committee. It does not represent a consensus view or recommendation from NIST, nor does it represent any policy positions of NIST.

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by organizations even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, organizations may wish to closely follow the development of these new publications by NIST.

The Election Assistance Commission (EAC) requested that the National Institute of Standards and Technology (NIST) research technologies to improve uniformed and overseas United States citizens' ability to vote, as required by the Uniformed and Overseas Citizens Absentee Voting Act (UOCAVA) [1]. Additionally, the Help America Vote Act of 2002 (HAVA) requires the Technical Guidelines Development Committee, with technical support from NIST, to study remote access voting, including voting over the Internet [2]. This report contains the results of NIST's research into threats and security technologies related to remote electronic voting for overseas and military voters.

Security Considerations for Remote Electronic UOCAVA Voting


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Supply Chain Risk Management?

[Assistant]
According to Hardware-Enabled Security_ Enabling a Layered Approach to Platform Security for Cloud and Edge Computing Use Cases:

5                                                                                |
|                                                                                | 3.2 The Chain of Trust                                                                                | (CoT)................................................................................ 6                                                                                |
|                                                                                | 3.3                                                                                | Supply Chain Protection .................................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.4 (NIST 3.3.4)?

[Assistant]
According to Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography:

3.3.4 KAS2-bilateral-confirmation... 3.3.4. 3.3.4 can be used to provide assurance to a key-pair owner acting as either party U or party V that both parties are in  possession of the correct private key; i.

Recommendation for Pair-Wise Key-Establishment Using Integer Factorization Cryptography


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] How does Foundational Cybersecurity Activities for IoT Device Manufacturers support CMMC certification?

[Assistant]
According to Foundational Cybersecurity Activities for IoT Device Manufacturers:

## NISTIR 8259

## Foundational Cybersecurity Activities for IoT Device Manufacturers

Michael Fagan Katerina N. Megas Karen Scarfone Matthew Smith

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8259

<!-- image -->

## NISTIR 8259

## Foundational Cybersecurity Activities

## for IoT Device Manufacturers

Michael Fagan Katerina N. Megas Applied Cybersecurity Division Information Technology Laboratory

Karen Scarfone Scarfone Cybersecurity Clifton, VA

Matthew Smith Huntington Ingalls Industries Annapolis Junction, MD

This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8259

May 2020

<!-- image -->

U.S. Department of Commerce Wilbur L. Ross, Jr., Secretary

National Institute of Standards and Technology Walter Copan, NIST Director and Under Secretary of Commerce for Standards and Technology

## National Institute of Standards and Technology Interagency or Internal Report 8259 36 pages (May 2020)

## This publication is available free of charge from: https://doi.org/10.6028/NIST.IR.8259

Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by NIST, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose. There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative.

Foundational Cybersecurity Activities for IoT Device Manufacturers


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Identification and Authentication?

[Assistant]
According to Security Recommendations for Server-based Hypervisor Platforms:

- Hypervisor host user account management
- Hypervisor host authentication and access control
- Routine administration of Host OS (e.g., keeping patches current)
- Routine administration of Guest OS
- Security of Guest OSs running on VMs
- Security of Applications/Services running on VMs

Configuration changes, module version changes, and patches affect the content of the hypervisor platform components such as BIOS, hypervisor kernel, and back-end device drivers running in the kernel. To ensure that each of these components that are part of the hypervisor stack can be trusted, it is necessary to check their  integrity  through  a  hardware-rooted  attestation  scheme  that  provides  assurance  of  boot  integrity. Checking integrity is done by cryptographically authenticating the hypervisor components that are launched. This authentication verifies that only authorized code runs on the system. Specifically, in the context of the hypervisor, the assurance of integrity protects against tampering and low-level targeted attacks such as root kits. If the assertion of integrity is deferred to a trusted third party that fulfills the role of trusted authority, the verification process is known as trusted attestation . Trusted attestation provides assurance that the code of the hypervisor components has not been tampered with. In this approach, trust in the hypervisor's components is established  based  on  trusted  hardware. In  other  words,  a  chain  of  trust  from  hardware  to  hypervisor  is established  with  the  initial  component  called the  root  of  trust . This  service  can  be  provided  by  a hardware/firmware infrastructure of the hypervisor host that supports boot integrity measurement and the attestation process. In short, a measured launch environment (MLE) is needed in the hypervisor host.

Security Recommendations for Server-based Hypervisor Platforms


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Risk Assessment?

[Assistant]
According to Prioritizing Cybersecurity Risk for Enterprise Risk Management:

As described in Section 2, prioritization and response will take place based on an analysis of risk scenarios to determine the likelihood that a threat source will act, that a vulnerability does or will exist and that an asset will experience an undesirable effect that impacts objectives. Assets are not limited to technology and include any resource that helps to achieve mission objectives (e.g., people, facilities, critical data, intellectual property, and services). By considering this information with other details from throughout the enterprise, stakeholders can review and monitor risk management to ensure that performance is aligned with enterprise strategy and direction. Because all risk is dynamic, monitoring also enables ongoing adjustments to risk appetite, risk identification methods, and risk response. A key challenge for risk managers is the confusion caused by common risk terms being used for divergent tasks. When considering the application of risk management processes in different contexts, communication among stakeholders may require additional information or clarification about activities. For example, even the meaning of the term control can vary depending on the context in which that term is used. OMB A-123 states that internal controls 'are tools to help program and financial managers achieve results and safeguard the integrity of their programs.' Internal controls provide leaders and managers with methods to help reasonably ensure the achievement of enterprise objectives related to ope rations, reporting, and compliance. As the enterprise's leadership establishes an environment by which those internal controls are enacted (the 'control environment'), they also perform a risk assessment to identify conditions that may prevent the effective application of those internal controls.

Prioritizing Cybersecurity Risk for Enterprise Risk Management


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Building a Cybersecurity and Privacy Learning Program:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.

Ensuring that a federal organization's workforce is aware of and prepared to respond appropriately and effectively to cybersecurity and privacy risks is an important effort that requires a strategic approach based on thoughtful planning, resource considerations, and leadership-driven decision-making. This long-awaited update to the 2003 NIST Special Publication (SP) 800-50, Building an Information Technology Security Awareness and Training Program, provides guidance to create and manage a program that includes cybersecurity and privacy awareness campaigns, role-based training, and other workforce education programs. These programs combine to create an overall Cybersecurity and Privacy Learning Program (CPLP) that is part of a larger organizational effort to reduce cybersecurity and privacy risks. The resulting CPLP supports federal requirements and incorporates industry-recognized best practices for risk management.

CPLPs must have actively managed plans throughout their life cycles, which requires attention and adjustment over time. CPLP managers should carefully and thoughtfully outline, discuss, review, and document the CPLP's goals and available options. When the owners of the organization's CPLP adopt an effective strategy and develop a proper planning approach with measurement and feedback throughout the year, the entire organization remains connected to

Building a Cybersecurity and Privacy Learning Program


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.1 (NIST 3.1.1)?

[Assistant]
According to Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities:

3.1.1, 3.

Secure Software Development Framework (SSDF) Version 1.1_ Recommendations for Mitigating the Risk of Software Vulnerabilities


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Interfaces for Personal Identity Verification_ Part 3 – PIV Client Application Programming Interface:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may be used by federal agencies even before the completion of such companion publications. Thus, until each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning and transition purposes, federal agencies may wish to closely follow the development of these new publications by NIST.

The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation's measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL's responsibilities include the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in Federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach efforts in information system security, and its collaborative activities with industry, government, and academic organizations.

Interfaces for Personal Identity Verification_ Part 3 – PIV Client Application Programming Interface


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Key Practices in Cyber Supply Chain Risk Management_ Observations from Industry:

There may be references in this publication to other publications currently under development by NIST in accordance with its assigned statutory responsibilities. The information in this publication, including concepts and methodologies, may  be  used  by  federal  agencies  even  before  the  completion  of  such  companion  publications. Thus,  until  each publication is completed, current requirements, guidelines, and procedures, where they exist, remain operative. For planning  and  transition  purposes,  federal  agencies  may  wish  to  closely  follow  the  development  of  these  new publications by NIST. - -Create explicit collaborative roles, structures, and processes for supply chain, cybersecurity, product security, physical security, and other relevant functions. - -Integrate cybersecurity considerations into the system and product life cycle. - -Determine supplier criticality by using industry standards and best practices. - -Mentor and coach suppliers to improve their cybersecurity practices. - -Include key suppliers in contingency planning (CP), incident response (IR), and disaster recovery (DR) planning and testing. - -Use third-party assessments, site visits, and formal certification to assess critical suppliers. Today, organizations increasingly rely on an array of suppliers to support the organization's critical functions. This trend has accelerated over the last decade and is expected to continue accelerating. Globalization, outsourcing, and digitization contribute to this trend. Suppliers have their own suppliers who, in turn, have their own suppliers, creating extended supply chains and entire supply ecosystems. All organizations rely on acquiring products and services, and most organizations also supply products and services to other organizations.

Key Practices in Cyber Supply Chain Risk Management_ Observations from Industry


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Guide to Information Technology Security Services provide? (Part 4)

[Assistant]
Phase 3:  Solution -decision makers evaluate potential solutions, develop the business case and specify the attributes of an acceptable service arrangement solution from the set of available options.
-  Phase 4:  Implementation -the organization selects and engages the service provider, develops a service arrangement, and implements the solution. -  Phase 5:  Operations -the organization ensures operational success by consistently monitoring service provider and organizational security performance against identified requirements, periodically evaluating changes in risks and threats to the organization and ensuring the organizational security solution is adjusted as necessary to maintain an acceptable security posture. -  Phase 6:  Closeout -the organization ensures a smooth transition as the service ends or is discontinued. This guide describes a life cycle that provides a context to assist organizations with managing the myriad issues surrounding IT security services. However, the guide does not prescribe or recommend any specific IT security service, IT security service arrangement, IT security service agreement, or IT security service provider. Each organization must perform its own analysis of its needs and assess, select, implement, and oversee the IT security service to best address its needs. The Guide should be used in conjunction with other NIST Special Publications (SP) that focus on procurement of IT systems, including NIST SP 800-64, Security Considerations in the Information System Development Life Cycle , and NIST SP 800-36: Guide to Selecting Information Technology Security Products . NIST SP 800-55, Security Metrics Guide for Information Technology Systems will help organizations understand the importance of using metrics and developing a metrics program. Other NIST special publications may be helpful in providing information on specific services and technologies.

Guide to Information Technology Security Services


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Case Studies in Cyber Supply Chain Risk Management_ Palo Alto Networks, Inc. provide? (Part 4)

[Assistant]
tment of Homeland Security's Information and Communications Technology Supply Chain Risk Management Task Force and the U.S. Customs and Border Protection's Customs-Trade Partnership Against Terrorism.
These programs encourage Palo Alto Networks' suppliers and the broader security community to develop robust supply chain and cybersecurity practices. - Contract manufacturers simplify cyber supply chain risk management. Managing thousands of supplier relationships is challenging for organizations at every maturity level. Palo Alto Networks leverages established contract manufacturers with demonstrably diligent cybersecurity and supplier risk management programs. <!-- image -->

## Organizational Approach to Supply Chain Risk and Cybersecurity

Given Palo Alto Networks' role as a cybersecurity vendor, the company is subject to intense scrutiny from potential customers and is a target for a variety of threat actors. Recognizing that a product security incident could have an enormous impact on customers, Palo Alto Networks considers cybersecurity and product integrity an implicit corporate mandate. All products are subject to the company's end-to-end product security framework (E2E Framework). The framework is designed to provide defense in depth for each stage of the product lifecycledesign, sourcing, manufacturing, fulfilment, and service. Each stage is independently evaluated to determine security risks, and domain experts select relevant public standards and best practices to target those risks. Selected standards include the Federal Information Processing Standards (FIPS) i , Common Criteria ii , and the United Kingdom's Commercial Product Assurance (CPA) iii . The E2E Framework is governed by the security council, which is composed of cross-functional senior management from product engineering, product line management, information security, product security, supply chain risk and compliance (SCRC), facility safety and security, and legal.

Case Studies in Cyber Supply Chain Risk Management_ Palo Alto Networks, Inc.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.3 (NIST 3.1.3)?

[Assistant]
According to Guidelines for Media Sanitization:

3.1.3. 3.1.3). 3.1.3) should be used.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to General Access Control Guidance for Cloud Systems:

AC policies to be stored and evaluated on the SaaS provider's side. This approach might  result  in  disclosing  sensitive  data  required  for  evaluating  the  AC  policies  to  the  SaaS provider.
Therefore, methods for enforcing authorization in the SaaS provider while not disclosing sensitive access control data to the SaaS provider should be considered. Federated authorization [36] is an efficient technique that utilizes a middleware layer to transfer the management of access control policies from the SaaS provider to the consumer side and enforce policies on the SaaS applications without disclosing sensitive data required for evaluating the policies.

General Access Control Guidance for Cloud Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Foundations of a Security Policy for Use of the National Research and Educational Network provide? (Part 4)

[Assistant]
cy Interim National Research and Education Network (IINREN). Other security policies and provisions should be expected as this evolves to national and international information networks in the future.
The draft policy outlined in the report is considered a level 1 policy in a theoretical hierarchy of policies. This hierarchy ranges from information technology codes of ethics through a number of refined levels of policies down to implementation specifications for security mechanisms, procedures and protocols that support and enforce the policies. Future research is planned to explore this range of policies in a number of security domains that can be defined within a broad distributed network. Dennis K. Branstad, Ph.D. NIST Fellow Project Advisor

## Executive Summary

The National Research and Education Network (NREN) is an integral part of the planned HighPerformance Computing and Communication (HPCC) infrastructure that will extend throughout the scientific, technical and education communities. The projected vision is one of desks and laboratory benches as entry points to a nation-wide electronic network of information technologies with shared access to services and resources such as high-performance computing systems, specialized software tools, databases, scientific instruments, digital libraries, and other research facilities. The problem of computer and network information security (one of the major computing issues of the day), will be complicated by the diversity of requirements as the NREN is designed, developed, and operated in collaboration with potential users in government, industry, research laboratories, and educational institutions. One major impediment to improved security is the lack of a clearly stated security policy for general computing. In recognition of this problem, national organizations are beginning to develop and publish codes of ethics for the use of computers.

Foundations of a Security Policy for Use of the National Research and Educational Network


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does Advanced Encryption Standard (AES) provide? (Part 3)

[Assistant]
al agencies may also use alternative methods that NIST has indicated are appropriate for this purpose. This Standard may be adopted and used by non-Federal Government organizations. 7. Specifications.
Federal Information Processing Standard (FIPS) 197, Advanced Encryption Standard (AES) (affixed). 8. Implementations. The algorithm specified in this Standard may be implemented in software, firmware, hardware, or any combination thereof. The specific implementation may depend on several factors, such as the application, the environment, the technology used, etc. The algorithm shall be used in conjunction with a FIPS-approved or NIST-recommended mode of operation. Object Identifiers (OIDs) and any associated parameters for AES used in

these modes are available at the Computer Security Objects Register (CSOR), located at https://csrc.nist.gov/projects/csor. NIST has developed a validation program to test implementations for conformance to the algorithms in this Standard. Information about the validation program is available at https: //nist.gov/cmvp. Examples for each key size are available at https://csrc.nist.gov/projects/aes. 9. Implementation Schedule. This Standard became effective on May 26, 2002. 10. Patents. Implementations of the algorithm specified in this Standard may be covered by U.S. and foreign patents. 11. Export Control. Certain cryptographic devices and technical data regarding them are subject to federal export controls. Exports of cryptographic modules implementing this Standard and technical data regarding them must comply with all federal laws and regulations and must be licensed by the Bureau of Industry and Security of the U.S. Department of Commerce. Information about export regulations is available at https://www.bis.doc.gov. 12. Qualifications. NIST will continue to follow developments in the analysis of the AES algorithm. As with its other cryptographic algorithm standards, NIST will formally reevaluate this Standard every five years.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice IA.L2-3.5.3 (NIST 3.5.3)?

[Assistant]
According to Guideline for Using Cryptographic Standards in the Federal Government_ Directives, Mandates and Policies:

3.5.3 Government-wide Responsibilities

The following provisions are directed by Section 6, 'Government-wide Responsibilities.

Guideline for Using Cryptographic Standards in the Federal Government_ Directives, Mandates and Policies


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to BIOS Protection Guidelines:

system BIOS without direct involvement from the user. 3. Rollback: System BIOS implementations that authenticate updates before applying them may also check version numbers during the update process.
In these cases, the system BIOS may have a special update process for rolling back the installed firmware to an earlier version. For instance, the rollback process might require the physical presence of the user. This mechanism guards against attackers flashing old firmware with known vulnerabilities. 4. Manual Recovery: To recover from a corrupt or malfunctioning system BIOS, many computer systems provide mechanisms to allow a user with physical presence during the boot process to replace the current system BIOS with a known good version and configuration. 5. Automatic Recovery: Some computer systems are able to detect when the system BIOS has been corrupted and recover from a backup firmware image stored in a separate storage location from the primary system BIOS (e.g., a second flash memory chip, a hidden partition on a hard drive).


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Cloud Environments:

Each service mesh instance has two main logical components: 1) a control plane that implements the APIs needed to define various configurations and policies that govern access between various microservices in that cluster and 2) a data plane that enforces those policies at runtime. However, a uniform set of policies is also needed to govern access between any pair of microservices or services in the enterprise irrespective of their location or the service mesh instance of which they are a part. This requires a global control plane that can define a uniform set of policies applicable to the entire set of services that operate in the enterprise and disseminate them to the control planes of the individual service mesh instances. It is technically possible to have a single service mesh control plane instance (i.e., single service mesh instance) that manages multiple clusters spanning multiple environments (i.e., on-premises and on clouds). However, this architecture may make the multiple clusters a single failure domain and potentially defeat the very purpose of designing a multi-cluster configuration (i.e., availability). Thus, running a service mesh control plane instance for each cluster isolates the failure domain and improves availability and scalability. Further, providing the required underlying network connectivity to facilitate every workload (since each workload or application instance has an associated sidecar proxy that forms the data plane) to communicate with a single

Note on the above recommendation: In an ideal situation, services would be authenticated for each service request. Since this is highly disruptive from the point of view of application transaction response, this authentication is accomplished at the connection level via mutual Transport Layer Security  (mTLS) when a service makes an initial connection establishment as part of its inter-service call. This authentication is not performed again in subsequent calls.

A Zero Trust Architecture Model for Access Control in Cloud-Native Applications in Multi-Cloud Environments


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Services Acquisition?

[Assistant]
According to Security Risk Analysis of Enterprise Networks Using Probabilistic Attack Graphs:

mation about  an  exploit  requires  human  effort  that  can  be  large. New  techniques  are  needed  to automatically get the exploit information for doing security analysis of enterprise networks.
- Attack graphs for networks with several hosts can contain cycles. These cycles need to be treated properly in security risk analysis. In [25, 34], some preliminary work on how to detect and handle such cycles has been done. Assuming monotonicity in the acquisition of network privileges, such cycles  should  be  excluded  in  doing  the  security  risk  analysis  using  attack  graphs. Handling cycles correctly is a key challenge in this work. - CVSS scores do not have a fine granularity. Currently the scores are coarse-grained in terms of High,  Medium,  and  Low. A  more  precise  scoring  system  will  improve  the  overall  results  of security risk analysis. - New  techniques  are  needed  to  model  zero-day  vulnerabilities  about  which  we  have  no  prior knowledge  or  experience. New  techniques  need  to  be  developed  for  security  risk  analysis  of networks against potential zero-day attacks. We have some preliminary results on modeling zero day attacks [35].

Security Risk Analysis of Enterprise Networks Using Probabilistic Attack Graphs


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice CA.L2-3.12.1 (NIST 3.12.1)?

[Assistant]
According to Digital Identity Guidelines_ Federation and Assertions:

3.12.1. 3.12.1. 3.12.1.

Digital Identity Guidelines_ Federation and Assertions


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Transitioning to the Security Content Automation Protocol (SCAP) Version 2:

- Endpoint: An Endpoint is the target of a posture assessment. Collection applications will collect software inventory, configuration settings, and other endpoint posture and publish this posture to Posture Collection Servers using standardized protocols and interfaces. These standards will enable Endpoints to be monitored and for changes in posture to be reported automatically. These standards will also allow Posture Collection Servers to query an Endpoint's posture when new or refreshed posture information is required. The initial release of SCAP 2.0 will define protocol requirements for desktops, laptops, and servers; however, all endpoint types are in scope for SCAP v2. Later revisions will define requirements for other endpoint types (e.g., network devices, mobile devices, IoT devices). - Posture Collection Server: This server is responsible for efficiently coordinating the collection of posture from multiple Endpoints. Posture collected from an Endpoint will be published by the Posture Collection Server to the Configuration Management Database (CMDB) where it can then be accessed by other tools. This reduces duplicate posture collection and load on Endpoints that have constrained capabilities, that are under significant load, or that have strict performance requirements. The Posture Collection Server acts as a point of integration for access control and for standardized management protocols including Network Endpoint Assessment (NEA), the Simple Network Management Protocol (SNMP), the Network Configuration Protocol (NETCONF), and mobile device management (MDM) protocols. - Posture Evaluator: By decoupling collection and evaluation and creating standardized interfaces, SCAP v2 enables the distribution of Posture Evaluator service instances across the network. A Posture Evaluator retrieves previously collected posture from a CMDB and requests new posture collection from Posture Collection Servers.

Transitioning to the Security Content Automation Protocol (SCAP) Version 2


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 3 require for Personnel Security?

[Assistant]
According to Assessing Enhanced Security Requirements for Controlled Unclassified Information:

| CHAPTERONE INTRODUCTION...................................................................................................... | CHAPTERONE INTRODUCTION...................................................................................................... | 1   |
|-----------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------|-----|
| 1.1                                                                                | PURPOSEANDAPPLICABILITY............................................................................................................. 1        | 2   |
| 1.2                                                                                | TARGET AUDIENCE.............................................................................................................................. |     |
| 1.3                                                                                | ORGANIZATIONOF THIS SPECIAL PUBLICATION................................................................................. | 2   |
| CHAPTERTWO THE FUNDAMENTALS............................................................................................ | CHAPTERTWO THE FUNDAMENTALS............................................................................................ | 3   |
| 2.1                                                                                | ASSESSMENT PROCEDURES................................................................................................................

Assessing Enhanced Security Requirements for Controlled Unclassified Information


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Physical Protection?

[Assistant]
According to Attribute Considerations for Access Control Systems:

The  Information  Technology  Laboratory  (ITL)  at  the  National  Institute  of  Standards  and Technology  (NIST)  promotes  the  U.S.  economy  and  public  welfare  by  providing  technical leadership  for  the  Nation's  measurement  and  standards  infrastructure.  ITL  develops  tests,  test methods, reference data, proof of concept implementations, and technical analyses to advance the development  and  productive  use  of  information  technology.  ITL's  responsibilities  include  the development of management, administrative, technical, and physical standards and guidelines for the cost-effective security and privacy of other than national security-related information in federal information systems. The Special Publication 800-series reports on ITL's research, guidelines, and outreach  efforts  in  information  system  security,  and  its  collaborative  activities  with  industry, government, and academic organizations.

As subject attributes may be provisioned by different authorities (e.g., human resources , security , organization leadership ,  etc.),  methods  for  obtaining  authoritative  data  must  be  regulated.  For example, only security authorities should be able to provision and assert clearance attributes and attribute values based on authoritative personnel clearance information; an individual should not be able to alter his or her own clearance attribute value. Other subject attributes may involve the subject's current tasking, physical location, and the device from which a request is sent. Processes need to be developed to assess and assure the quality of such subject attribute data.

Attribute Considerations for Access Control Systems


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Guide to Security for Full Virtualization Technologies:

ss method is just username and password, but some bare metal hypervisors offer additional controls such as hardware token-based authentication to grant access to the hypervisor's management interface.
On some systems, there are different levels of authorization, such as allowing some users to view logs but not be able to change any settings or interact directly with the guest OSs. These view-only user accounts allow auditors and others to have sufficient access to meet their needs without reducing overall security.

Guide to Security for Full Virtualization Technologies


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Recommendations for Discrete Logarithm-based Cryptography_ Elliptic Curve Domain Parameters:

## Conformance Testing

Conformance testing for implementations of this Recommendation will be conducted within the framework of the Cryptographic Algorithm Validation Program (CAVP) and the Cryptographic Module Validation Program (CMVP). The requirements of this Recommendation are indicated by the word ' shall .' Some of these requirements may be out of scope for CAVP or CMVP validation testing and are thus the responsibility of entities using, implementing, installing, or configuring applications that incorporate this Recommendation.

Recommendations for Discrete Logarithm-based Cryptography_ Elliptic Curve Domain Parameters


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Personnel Security?

[Assistant]
According to Developing Cyber-Resilient Systems_ A Systems Security Engineering Approach:

Although the focus of [ISO 15288] is systems and software engineering processes, operational
resilience, which includes cyber resiliency for systems that include or depend on cyber resources,
is  addressed  indirectly  by  requiring  organization-wide  commitment, resources, practices,  and
processes. The interacting elements in the definition of a system include layers of resilience in
hardware, software, data, information, humans, processes, procedures, facilities, materials, and
naturally occurring physical entities. This is important because if the organization’s missions or
business  functions  require  sustainability during  perturbations,  disruptions,  disturbances,  or
cyber-attacks, then operational resilience practices and procedures must be applied to all of the
system’s  assets. It  would  be of limited  value  to have  resilience  measures  implemented  in  the
software  architecture  if  there  is  no  redundancy  and  survivability  in  the  hardware,  if  the
communications  networks  are  fragile,  if  critical  personnel  are  not  available  (e.g.,  in  a  natural
disaster or inclement weather) to operate and maintain the system, or if there are no facilities
available for producing the organization’s products and/or services. “Providing satisfactory security controls in a computer system is in itself a system design problem. A
combination of hardware, software, communications, physical, personnel and administrative-
procedural safeguards is required for comprehensive security. In particular, software safeguards
alone are not sufficient.”

An adversary that possesses sophisticated levels of expertise and
significant resources that allow it to create opportunities to
achieve its objectives by using multiple attack vectors including,
for example, cyber, physical, and deception.

Developing Cyber-Resilient Systems_ A Systems Security Engineering Approach


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Access Control?

[Assistant]
According to Proceedings of the Cybersecurity in Cyber-Physical Systems Workshop, April 23-24, 2012:

sential for patient safety in emergency conditions from patient personally identifiable information/data to allow different authentication and access control mechanisms to apply to each group of data.
Alternately,  identifying  different  modes  of  operation (such  as  home  health  setting  versus  open  environment  versus emergency situation) to allow the IMD to apply different authentication and access control mechanisms in different modes.

Proceedings of the Cybersecurity in Cyber-Physical Systems Workshop, April 23-24, 2012


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile:

- NIST research and publications on trustworthy and responsible AI, including the Artificial Intelligence Risk Management Framework (AI RMF 1.0) [2], Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations [3], Towards a Standard for Identifying and Managing Bias in Artificial Intelligence [4], and the Dioptra experimentation testbed for security evaluations of machine learning algorithms [5]. - NIST's Secure Software Development Framework (SSDF) Version 1.1 [6], which is a set of fundamental, sound, and secure software development practices. It provides a common language to help facilitate communications among stakeholders, including software producers and software acquirers. The SSDF has also been used in support of EO 14028, Improving the Nation's Cybersecurity [7], to enhance software supply chain security. - NIST general cybersecurity resources, including The NIST Cybersecurity Framework (CSF) 2.0 [8], Security and Privacy Controls for Information Systems and Organizations [9], and Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations [10]. - AI model developers, AI researchers, AI system developers, and secure software practitioners from industry and government with expertise in the unique security challenges of AI models and the practices for addressing those challenges. This expertise was primarily captured through NIST's January 2024 workshop, where speakers and attendees shared suggestions for adapting secure software development practices and tasks to accommodate the unique aspects of AI model development and the software leveraging them. AI model producers, AI system producers, AI system acquirers, and others can use the SSDF to foster their communications regarding secure AI model development throughout the software development life cycle.

Secure Software Development Practices for Generative AI and Dual-Use Foundation Models_ An SSDF Community Profile


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC Level 2 require for System and Information Integrity?

[Assistant]
According to Computer Security Division 2009 Annual Report:

The Computer Security Division (CSD), a component of NIST's Information  Technology  Laboratory  (ITL),  provides  standards  and technology to protect information systems against threats to the confidentiality, integrity, and availability of information and services. During Fiscal Year 2009 (FY2009), CSD continued its standards development and cybersecurity outreach activities and carried out an  expanded  research  agenda  designed  to  develop  and  implement high-quality, cost-effective mechanisms needed to improve information  security  and  privacy  across  the  federal  government and throughout the national and international information security community. CSD worked with federal partners to establish a unified framework for information security across the federal government. This initiative is resulting in greater standardization and more consistent and cost-effective security for all federal information systems. We also invite public and private organizations to submit their information security practices to be considered for inclusion on the list of practices maintained on the website. Policies and procedures may be submitted to us in any area of information security, includ- ing accreditation, audit trails, authorization of processing, budget planning  and  justification,  certification,  contingency  planning, data  integrity,  disaster  planning,  documentation,  hardware  and system  maintenance,  identification  and  authentication,  incident handling and response, life cycle, network security, personnel security, physical and environmental protection, production input/ output controls, security policy, program management, review of security  controls,  risk  management,  security  awareness  training and education (including specific training course and awareness materials), and security planning.

Computer Security Division 2009 Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Audit and Accountability?

[Assistant]
According to Computer Security Division 2012 Annual Report:

df00)ing and  International  Trade  Center  in  Washington,  D.C. The conference offered important sessions that focused on broad topics of interest to the healthcare and health IT security community.
Over 500 attendees from federal, state, and local governments, academia, HIPAA-covereGLYPH(cmap:df00) entities anGLYPH(cmap:df00) business associates, industry groups, and vendors heard from, and interacteGLYPH(cmap:df00) with,  healthcare,  security,  anGLYPH(cmap:df00)  privacy experts on technologies and methodologies for safeguarding health information and for implementing the requirements of the HIPAA Security Rule. Presentations  covered  a  variety  of  current  topics including updates on OCR's health information privacy and security audit and enforcement activities; establishing an access audit program; securing mobile devices;  securing  health  information  in  the  Cloud;

Computer Security Division 2012 Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AC.L2-3.1.8 (NIST 3.1.8)?

[Assistant]
According to Guidelines for Managing the Security of Mobile Devices in the Enterprise:

3.1.8. 3.1.8.

Guidelines for Managing the Security of Mobile Devices in the Enterprise


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What additional guidance does The NIST Cybersecurity Framework (CSF) 2.0 provide? (Part 5)

[Assistant]
pecific outcomes. Suggestions for how specific outcomes may be achieved are provided in an expanding suite of online resources that complement the CSF, including a series of Quick Start Guides (QSGs).
Also, various tools offer downloadable formats to help organizations that choose to automate some of their processes. The QSGs suggest initial ways to use the CSF and invite the reader to explore the CSF and related resources in greater depth. Available through the NIST CSF website, the CSF and these supplementary resources from NIST and others should be viewed as a 'CSF portfolio' to help manage and reduce risks. Regardless of how it is applied, the CSF prompts its users to consider their cybersecurity posture in context and then adapt the CSF to their specific needs. Building on previous versions, CSF 2.0 contains new features that highlight the importance of governance and supply chains . Special attention is paid to the QSGs to ensure that the CSF is relevant and readily accessible by smaller organizations as well as their larger counterparts. NIST now provides Implementation Examples and Informative References , which are available online and updated regularly. Creating current and target state Organizational Profiles helps organizations to compare where they are versus where they want or need to be and allows them to implement and assess security controls more quickly. Cybersecurity risks are expanding constantly, and managing those risks must be a continuous process. This is true regardless of whether an organization is just beginning to confront its cybersecurity challenges or whether it has been active for many years with a sophisticated, well-resourced cybersecurity team. The CSF is designed to be valuable for any type of organization and is expected to provide appropriate guidance over a long time. ## 1. Cybersecurity Framework (CSF) Overview

This document is version 2.0 of the NIST Cybersecurity Framework ( Framework or CSF ).

The NIST Cybersecurity Framework (CSF) 2.0


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Introduction to Cybersecurity for Commercial Satellite Operations:

| Functions   | Subcategories                                                                                | Informative                                     | Reference                                       |
|-------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------|-------------------------------------------------|
|             |                                                                                | SP 800-53, Rev. 4                               | SP 800-53, Rev. 5                               |
|             | PR.DS-6: Integrity-checking mechanisms are used to verify software, firmware, and information integrity. | SI-7                                            | SI-7, SI-10                                     |
|             | PR.DS-8: Integrity-checking mechanisms are used to verify hardware integrity. | SI-7                                            | SI-7                                            |
|             | PR.IP-1: A baseline configuration of information technology/industrial control systems that incorporates security principles (e.g., concept of least functionality) is created and maintained. | CM-2, CM-3, CM-4, CM-5, CM-6, CM-7, CM-9, SA-10 | CM-2, CM-3, CM-4, CM-5, CM-6, CM-7, CM-9, SA-10 |
|             | PR.IP-3: Configuration change control processes are in place.

Introduction to Cybersecurity for Commercial Satellite Operations


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Threat Assessment of Malicious Code and External Attacks:

tributed Intrusion Detection System) -motivation, architecture, and an early prototype. In Proceedings of the lfth National Computer Security Conference , 1991. - [SH82] John F. Shoch and Jon A. Hupp.
The 'worm' programs -early experience with a distributed computation. Association for Computing Machinery , 25(3), March 1982. - [Spa89] Eugene Spafford. The internet worm program: An analysis. Computer Communication Review , 19(1), January 1989. - [Wac91] John Wack. Establishing a Computer Security Incident Response Capability (CSIRC). NIST Special Publication 800-3, National Institute of Standards and Technology, 1991.

Threat Assessment of Malicious Code and External Attacks


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Security Assessment?

[Assistant]
According to Federal S_MIME V3 Client Profile:

| Cryptographic Algorithm Suite Conformance........................................................
| 3                                                                                |
| 2.1.2                                                                                | PKI Profile Conformance ....................................................................................... | 4                                                                                |
| 2.1.3                                                                                | Cryptographic Messaging Systems (CMS) Content Types .................................... | 5                                                                                |
| 2.1.4                                                                                | MIME Encoding                                                                                | ..................................................................................................... 5                                       |
| 2.1.5                                                                                | Mail Access Protocols (POP/IMAP)                                                                                | ......................................................................


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice IR.L2-3.6.7 (NIST 3.6.7)?

[Assistant]
According to Personal Identity Verification (PIV) of Federal Employees and Contractors:

3.6.7 | This specifies that the public key MAY be used to verify signatures on CHUIDs and biometric data records.

Personal Identity Verification (PIV) of Federal Employees and Contractors


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for System and Communications Protection?

[Assistant]
According to Computer Security Division 2004 Annual Report:

- Standards to be used by Federal agencies to categorize information and information systems based on the objectives of providing appropriate levels of information security according to a range of risk levels Developed Special Publication (SP) 800-37, Guidelines for the Security Certification and Accreditation of Federal Information Technology Systems (final version issued May 2004) - Guidelines recommending the types of information and information systems to be included in each category Developed and issued FIPS 199, Standards for Security Categorization of Federal Information and Information Systems (final version issued February 2004) - Minimum information security requirements (management, operational and technical security controls) for information and information systems in each such category Developed SP 800-53, Security Controls for Federal Information Systems (first public draft issued October 2003), and continued work on SP 800-53A, Guide for Assessing the Security Controls in Federal Information Systems (first public draft to be issued January 2005) - Incident detection and handling guidelines Developed SP 800-61, Computer Security Incident Handling Guide (final version issued January 2004) - Provide assistance to agencies and private sector Conduct ongoing, substantial reimbursable and non-reimbursable assistance support, including many outreach efforts such as the Federal Information Systems Security Educators' Association (FISSEA), the Federal

Computer Security Division 2004 Annual Report


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Configuration Management?

[Assistant]
According to Metrics and Methodology for Hardware Security Constructs:

|   ID | Description                            |
|------|----------------------------------------|
|   26 | Leveraging Race Conditions             |
|  113 | Interface Manipulation                 |
|  114 | Authentication Abuse                   |
|  122 | Privilege Abuse                        |
|  124 | Shared Resource Manipulation           |
|  176 | Configuration/Environment Manipulation |
|  188 | Reverse Engineering                    |
|  192 | Protocol Analysis                      |
|  233 | Privilege Escalation                   |
|  441 | Malicious Logic Insertion              |
|  624 | Hardware Fault Injection               |

Metrics and Methodology for Hardware Security Constructs


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Planning?

[Assistant]
According to Getting Ready for Post-Quantum Cryptography_ Exploring Challenges Associated with Adopting and Using Post-Quantum Cryptographic Algorithms:

...6 |

standards is completed. Unfortunately, the implementation of post-quantum public-key standards is likely to be more problematic than the introduction of new classical cryptographic algorithms.
In the absence of significant implementation planning, it may be decades before the community replaces most of the vulnerable public-key systems currently in use.

Getting Ready for Post-Quantum Cryptography_ Exploring Challenges Associated with Adopting and Using Post-Quantum Cryptographic Algorithms


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AU.L2-3.3.5 (NIST 3.3.5)?

[Assistant]
According to Standard Security Label for GOSIP_ an Invitational Workshop:

3.3.5 Security Tag Type 4    | 4. 3.3.5 Security Tag Type 4    | 4. 3.3.5 Security Tag Type 4    | 4.

Standard Security Label for GOSIP_ an Invitational Workshop


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What is CMMC practice AT.L2-3.2.3 (NIST 3.2.3)?

[Assistant]
According to Guidelines for Smart Grid Cybersecurity:

3.2.3

U. 3.2.3

Identity-Based Encryption

Key distribution and key revocation are some of the most fundamental problems in key
distribution for systems.


[System] You are a CMMC (Cybersecurity Maturity Model Certification) expert with deep knowledge of NIST SP 800-171, SP 800-172, and defense contractor cybersecurity requirements. You provide accurate guidance on CMMC compliance, CUI protection, and DoD security controls.

[User] What does CMMC require for Incident Response?

[Assistant]
According to Case Studies in Cyber Supply Chain Risk Management_ Mayo Clinic:

| Company Overview.................................................................................................................2         |
|--------------------------------------------------------------------------------------------------------------------------------------------|
| Risk Profile ..........................................................................................................................2   |
| Highlighted Practices in Cyber Supply Chain Management ..................................................2                                 |
| Organizational Approach to Supply Chain Risk and Cybersecurity............................................3                                |
| Supplier Management.............................................................................................................3          |
| Key Aspects of Managing Supplier Relationships .................................................................3                          |
| Measuring Supplier Risk ......................................................................................................4            |
| Quality Management and Continuous Improvement...........................................................4                                  |
| Incident Response and Recovery .........................................................................................4                  |
| Lessons Learned and Improvement Opportunities ..................................................................5                          |
| References ..............................................................................................................................5 |

## Incident Response and Recovery

The key focus of the Mayo Clinic's cybersecurity and supply chain incident response plans is the continuation of patient care.

Case Studies in Cyber Supply Chain Risk Management_ Mayo Clinic